CVE-2026-2982 · Package
NO FIX YET
The WP Table Builder plugin for WordPress does not sanitize the 'url' parameter when saving table data, so script stored in it runs in pages. An authenticated contributor-level user can make visitors' browsers run attacker-supplied scripts whenever they open an affected page.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the WP Table Builder plugin at version 2.1.7 or earlier where contributor-level or higher accounts can create tables. Lower-privileged roles are only exposed if an administrator has explicitly allowed them in plugin settings. Sites without this plugin or with only trusted editors can skip it.
Not affected if no-untrusted-contributors, plugin-not-installed, roles-not-enabled
Who cares wordpress, wp-table-builder
2.1.7 are affected.No fix yet, per the sources.
The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation by lower-privileged users requires an administrator to explicitly allow those roles in plugin settings. While it is possible to assign subscriber-level roles with the ability to create tables, such privileges are usually assigned to the more appropriate contributor, author, or editor level roles.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.